Terraform: Azure Key Vault sets expiration_date using a local. Trivy says expiration date should be set

[SvenAelterman]

IDs

AVD-AZU-0017

Description

Trivy does not see that the expiration date for the secret is set in the following Terraform code:

locals {
  start_year  = tonumber(formatdate("YYYY", var.secret_expiration_date_seed))
  start_month = formatdate("MM", var.secret_expiration_date_seed)
  start_day   = formatdate("DD", var.secret_expiration_date_seed)
  next_year   = local.start_year + 1
  next_date   = "${local.next_year}-${local.start_month}-${local.start_day}"

  secret_expiration_date = "${local.next_date}T00:00:00Z"
}

resource "azurerm_key_vault_secret" "wp_admin_password" {
  name         = local.wpadmin_password_kv_secret_name
  value        = resource.random_password.wpadmin_random_password.result
  key_vault_id = data.azurerm_key_vault.key_vault.id

  content_type    = "The wpadmin password for the WordPress site ${var.site_name}."
  expiration_date = local.secret_expiration_date
}

Reproduction Steps

See code above

Target

Filesystem

Scanner

Misconfiguration

Target OS

N/A

Debug Output

(body too long error when pasting it)

Version

0.61.1

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[nikpivkin]

Hi @SvenAelterman !

Is the secret_expiration_date_seed variable set by default or via .tfvars?

[SvenAelterman]

Yeah, I just came here to say that I wasn't aware that trivy doesn't use the default tfvars files. After specifying --tf-vars explicitly, the detection went away!

It does raise a question: when using the VS Code extension, how can we tell it which tfvars file to use?

[SvenAelterman]

Actually, I think I see the answer here: https://trivy.dev/v0.57/docs/references/configuration/config-file/#:~:text=Unlicense%0A%20%20%20%2D%200BSD-,Misconfiguration%20options,-misconfiguration%3A%0A%20%20%23%20Same

[nikpivkin]

You can create a config file and specify the path to the variable files there.

[SvenAelterman]

Great, that's what it looked like from the docs :).

If I have a repo with multiple root modules, do I specify a single config file for the whole repo and put all tfvars files in the array, or should I create a config file for trivy in each of the root module folders?

[SvenAelterman]

I've got it all sorted. Thanks for the assistance!

[SvenAelterman]

If anyone is interested, it was implemented in this open-source repo: https://github.com/SvenAelterman/BitnamiWordPressOnAzureTerraform/blob/main/trivy.yaml